How to get pfSense WAN to accept VLAN 0

[stephenw10]

It would for any NIC except an e1000. At least any that I've tested.
For em/igb you need to disable vlan_hwfilter. Currently.

Steve

[michaellacroix]

@stephenw10

Great find!

[stephenw10]

What would confirm that as the source of confusion would be if the cases where two seemingly identical boxes had different behaviour actually had different NIC chips and only one supported vlan_hwfilter.

Steve

[michaellacroix]

@stephenw10

Hi Stephen, does netgate make any type of release notes for the daily snapshots? As they move along I'm curious as to what issues were addressed. Thanks

[stephenw10]

Not beyond the commit logs in github. At least not publicly:
https://github.com/pfsense/pfsense/commits/master

Steve

[Schwiing]

Just got Frontier Fiber installed today (2Gig Service). Hooked the FRX523 to my PFsense router and it got an IP immediately. No need to strip the tag. I did have a few weird speed tests (940/920, 200/600) but after that it's been almost consistent with 2.5/2.5G.

Not that this is extremely useful here, but it's a data point nonetheless.

[stephenw10]

In 2.6 or 2.7-dev?

[Schwiing]

@stephenw10 in 22.05. My thought is just that Frontier isn't using Vlan0 here. But I'm also not entirely sure one way or the other aside from the result. Is there a way for me to check?

[michaellacroix]

@schwiing

I took a pcap a couple of weeks ago and the vlan 0 tag was there. I also have frontier in CT. Are you familiar with wireshark?

[stephenw10]

Yes, it would fail in 22.05 if they were tagging. You can run a packet capture on WAN for port 68 and then renew the dhcp lease. If you then view it at full detail you will see any tagging in the replies.

Steve

[Schwiing]

@stephenw10 @michaellacroix

I'm familiar with Wireshark but have only run it once and that was a long time ago. I may need some help to figure that one out.

I'm sure there's some good guides on the web though. Can report back once I figure it out

[michaellacroix]

@schwiing

Stephens idea is better to use pfsense built-in packet capture.

[Schwiing]

@michaellacroix @stephenw10

https://imgur.com/a/XVWf81D

Any other settings to change here?

[stephenw10]

I always enable promiscuous mode to be sure but that shouldn't be required here. I won't hurt either.

[Schwiing]

@stephenw10 Ok. I ran a packet capture and renewed WAN + relinquished my lease. Didn't get an IP back so I had to reboot the ONT, after which I got an IP back. Stopped the capture and got a .cap file. Here's what it says (masked my IP):

07:44:40.852150 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
07:44:41.370617 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
07:44:43.018973 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
07:44:54.521561 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
07:44:55.069179 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
07:44:56.103103 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
07:44:57.061862 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
07:44:59.010410 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
07:45:03.113370 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
07:45:03.131465 IP xx.xx.xx.1.67 > xx.xx.xx.xx.68: UDP, length 300
07:45:07.694198 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
07:45:07.731435 IP xx.xx.xx.1.67 > xx.xx.xx.xx.68: UDP, length 300

Did I do it right? Can't really tell.

[stephenw10]

Yes, now change the detail level to full and hit 'view capture'. Scroll down to the replies and see if there are any tags.

[Schwiing]

@stephenw10 Ah, i didn't set it to full before - good catch.

Apologies for the dumb question but, what does the tag look like? What term should I search for?

[stephenw10]

Like I showed above, here.

Where is shows vlan 0, p 4, That's priority tagged as 4.

[Schwiing]

@stephenw10 I don't see the term "vlan" anywhere in that packet capture. My guess (if I did it correctly) is that it's not tagged.

[stephenw10]

Yeah, I'd be amazed if it was and still worked in 22.05. Good to check though.